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(54) Remotely programmable subscriber terminal in a wireless telecommunications system 



(57) A subscriber station 20 for the wireless connection of user telecommunications equipment to a remote 
central station 10 of a wireless telecommunications system 1 includes a transceiver (23, fig. 2) for wireless 
communication with the central station, at least one telephonje outlet for connection to subscriber 
telecommunications equipment and a communications controller connected between the transceiver and the 
telephone outlet for processing signals for transmission and/or received signals. The subscriber station is 
configurable in response to wireless programming signals representative of control code down-loaded from 
the central station. The software subsequently produced is stored alternately in one of two memory banks and 
each update has a version number so that the subscriber station can determine, and run, the most recent, valid 
version number. The ability to download software for programming the subscriber station, greatly enhances 
the flexibility and convenience of configuration of the subscriber station, both initially and subsequently. 




At least one drawing originally filed was informal and the print reproduced here is taken from a later filed formal copy. 
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RECONFIGURABLE SUBSCRIBER TERNONAL FOR 
A WIRELESS TELECOMMUNICATIONS SYSTEM 

The present invention relates in general to telecommunications systems and 
5 more particularly to the configuring of a subscriber terminal of a wireless 
telecommunications system., 

A wireless telecommunications system has been proposed with a central 
terminal, or station, at a central location in wireless communication with a plurality' 
of subscriber terminsils, or stations, at subscriber locations to implement a wireless 

10 telephony system. The system is intended to be used with fixed subscriber locations 
rather than the more familiar mobile cellular telephone systems. 

The system finds a wide variety of possible applications, for example in rural, 
remote, or sparsely populated areas where the cost of laying permanent wire or optical 
networks would be too expensive, in heavily built-up areas where conventional wired 

1 5 systems are at full capacity or the cost of laying such systems would involve too much 
interruption to the existing infrastructure or be too expensive, and so on. 

In the proposed system, the subscriber terminal is required to perform wireless 
transmission and reception tasks, signal coding and decoding tasks, initialisation and 
authentication tasks as well conventional telephony tasks. Function for executing these 

20 tasks can be set up at the initial installation of the subscriber unit at a customer's 
location. However, it may be desired to update the functions available at the 
customer's premises after installation. Particularly bearing in mind that the subscriber 
stations may be widely scattered, it is inconvenient to have to visit each subscriber 
station in order to provide for re-programming of the subscriber station. 

25 It may be desirable in some instances to ensure that standard installation is 

effected for all subscriber stations. In other instances, it may be desirable to provide 
different installations at different subscriber stations. The administration in ensuring 
that installers have the correct equipment at subscriber stations is significant. 
Accordingly, it can be seen that the programming and installation of subscriber stations 

30 is a potentially costly and inconvenient operation. The invention seeks to address 
these problems. 
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In accordance with the invention, therefore, there is provided a subscriber 
station for the wireless connection of user telecommunications equipment to a remote 
central station of a wireless telecommunications system, the subscriber station 
comprising a transmitter/receiver for wireless communication with the central station, 

5 at least one telephone line for connection to subscriber telecommunications equipment 
and a communications controller connected between the transmitter/receiver and the 
telephone line for processing signals for transmission and/or received signals, the 
subscriber station being configurable in response to wireless programming signals 
representative of control code down-loaded from the central station. 

10 By enabling the down-loading of software for programming the subscriber 

station, the flexibility and convenience of configuring the subscriber station, both 
initially and subsequently, is greatly enhanced. 

Preferably, the communications controller comprises one or more memories 
loadable with control code down-loaded from the central station and a processor 

1 5 arranged to execute the control code for configuring the subscriber station. 

More preferably, the subscriber station includes two memories for storing 
control code, wherein the communications controller is arranged to store successive 
updates of control code received from the central station alternately in the control 
memories, each update has an associated version number and the processor is arranged 

20 to execute the control code having the most recent valid version number. This 
facilitates successive updates to the programming of the subscriber station and the 
correct identification of the current version of the software for configuring the 
subscriber station. 

Preferably, the subscriber station includes a reset state machine responding to 
25 a reset state to determine which memory contains the control code having the most 
recent valid version number. 

In the preferred embodiment of the invention, each memory is a flash memory 
and the processor is a microcontroller. 

In one embodiment of the invention, the communications controller comprises 
30 a digital signal processor and/or a programmable storage unit, the processor configures 
the digital signal processor and/or the programmable storage unit with the control 
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code. 

In the preferred embodimeni the transmitter/receiver comprises at leasi one 
aerial and is contained with the communications controller in a common housing to 
be mounted on a structure to permit wireless communication between the subscriber 
5 station and the remote central station. A drop cable is provided for connection to a 
power supply unit and for connection of the user telecommunication equipment. 

The invention also provides a wireless telecommunications system comprising 
at least one the subscriber station as defined above and a central station, the central 
station being arranged to transmit programming information to the subscriber station 
10 for configuring the subscriber station. 

In accordance with another aspect of the invention, there is provided a method 
of programming a subscriber station for wireless connection of telecommunications 
equipment to a remote central station of a wireless telecommunications system, the 
method comprising: 

15 transmitting wireless programming signals representative of control code from 

the central station to the subscriber station, 

receiving the programming signals at the subscriber station; and 
configuring the subscriber station in response to the control code represented 
by the programming signals down-loaded from the central station. 
20 An embodiment of the invention will be described hereinafter, by way of 

example only, with reference to the accompanying drawings in which like reference 
signs are used for like features and in which: 

Figure 1 is a schematic overview of an example of a wireless 
telecommunications system; 
25 Figure 2 is a schematic illustration of an example of a subscriber terminal of 

the telecommunications system of Figure 1 ; 

Figure 3 is a schematic illustration of an example of a central terminal of the 
telecommunications system of Figure 1 ; 

Figure 3A is a schematic illustration of a modem shelf of a central terminal of 
30 the telecommunications system of Figure 1; 

Figure 4 is an illustration of an example of a frequency plan for the 
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telecommunications system of Figure 1 ; 

Figures 5 A and 5B are schematic diagrams illustrating possible configurations 
for cells for the telecommunications system of Figure 1 ; 

Figure 6 is a schematic diagram illustrating aspects of a code division multiplex 
5 system for the telecommunications system of Figure 1; 

Figuire 7 is a schematic diagram illustrating signal transmission processing 
stages for the telecommunications system of Figure 1 ; 

Figure 8 is a schematic diagram illustrating signal reception processing stages 
for the telecommunications system of Figure 1 ; 
10 Figure 9 is a schematic diagram illustrating downlink and uplink 

communication paths for the wireless telecommunications system; 

Figure 10 is a schematic diagram illustrating a downlink signal transmitted by 
the central terminal; 

Figure 1 1 is a graphical diagram illustrating the contents of a frame 
15 information signal within the downlink signal; 

Figure 12 is a tabular depiction illustrating overhead insertion into a data 
stream of the downlink signal; 

Figure 13 is a schematic diagram, partially in cross-section of part of a 
subscriber terminal; 

20 Figure 14 is a functional block diagram of a communication controller of a 

subscriber terminal; 

Figure 15 is a schematic block diagram of hardware elements of the 
communications controller of Figure 14; 

Figure 16 is a schematic block diagram of other elements of the 
25 communications controller of Figure 14; 

Figure 17 is a schematic diagram illustrating the mapping of the address space 
of a microcontroller of the conununications controller; 

Figure 18 illustrates various states of a state machine of the communications 
controller of Figure 14. 
30 Figure 19 illustrates a configuration of code within a memory; 

Figure 20 illustrates an instance of a boot-strap service; 
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Figures 21 and 22 illustrate state machines for cold and warm boot-straps; 
Figure 23 is a schematic block diagram illustrating an example of various 
control protocols; 

Figure 24 is a schematic representation of a layered communication protocol; 
5 Figure 25 is a schematic representation of the virtual flow of messages between 

master and slave layers; 

Figure 26 is a schematic representation of message flow; 
Figure 27 illustrates a layer 4 state machine implemented at a central terminal; 
Figure 28 illustrates a layer 4 state machine implemented at a subscriber 
10 terminal; 

Figure 29 illustrates a layer 3 state machine implemented at the central 
terminal; 

Figure 30 illustrates a layer 3 state machine implemented at the subscriber 
terminal; 

15 Figure 31 illustrates a layer 2 state machine implemented at the central 

terminal; 

Figure 32 illustrates a layer 2 state machine implemented at the subscriber 
terminal; 

Figure 33 illustrates three types of messages used for transmitting data; and 

20 Figure 34 represents a response message. 

Figure 1 is a schematic overview of an example of a wireless 
telecommunications system. The telecommunications system includes one or more 
service areas 12, 14 and 16, each of which is served by a respective central terminal 
(CT) 10 which establishes a radio link with subscriber terminals (ST) 20 within the 

25 area concerned. The area which is covered by a central terminal 10 can vary. For 
example, in a rural area with a low density of subscribers, a service area 12 could 
cover an area with a radius of 15-20Km- A service area 14 in an urban environment 
where is there is a high density of subscriber terminals 20 might only cover ah area 
with a radius of the order of 100m. In a suburban area with an intermediate density 

30 of subscriber terminals, a service area 16 might cover an area with a radius of the 
order of IKm. It will be appreciated that the area covered by a particular central 
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terminal 10 can be chosen to suit the local requirements of expected or actual 
subscriber density, local geographic considerations, etc, and is not limited to the 
examples illustrated in Figure 1. Moreover, the coverage need, not be, and typically 
will not be circular in extent due to antenna design considerations, geographical 

5 factors, buildings and so on, which will affect the distribution of transmitted signals. 

The central terminals 10 for respective service areas 12, 14, 16 can be 
cormected to each other by means of links 13, 15 and 17 which interface, for example, 
with a public switched telephone network (PSTN) 18. The links can include 
conventional telecommunications technology using copper wires, optical fibres, 

10 satellites, microwaves, etc. 

The wireless telecommunications system of Figure 1 is based on providing 
fixed microwave links between subscriber terminals 20 at fixed locations within a 
service area (e.g., 12, 14, 16) and the central terminal 10 for that service area. In a 
preferred embodiment each subscriber terminal 20 is provided with a permanent fixed 

15 access link to its central terminal 10. However, in alternative embodiments demand- 
based access could be provided, so that the number of subscribers which can be 
serviced exceeds the number of telecommunications links which can currently be 
active. 

Figure 2 illustrates an example of a configuration for a subscriber terminal 20 
20 for the telecommunications system of Figure 1. Figure 2 includes a schematic 
representation of customer premises 22. A customer radio unit (GRU) 24 is mounted 
on the customer's premises. The customer radio unit 24 includes a flat panel anterma 
or the like 23. The customer radio unit is mounted at a location on the customer's 
premises, or on a mast, etc., and in an orientation such that the flat panel anterma 23 
25 within the customer radio unit 24 faces in the direction 26 of the central terminal 10 
for the service area in which the customer radio unit 24 is located. 

The customer radio unit 24 is cormected via a drop line 28 to a power supply 
unit (PSU) 30 within the customer's premises. The power supply unit 30 is connected 
to the local power supply for providing power to the customer radio unit 24 and a 
30 network terminal unit (NTU) 32. The customer radio unit 24 is also connected to via 
the power supply unit 30 to the network terminal unit 32, which in turn is cormected 
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to telecommunications equipment in the customer's premises, for example to one or 
more telephones 34, facsimile machines 36 and computers 38. The 
telecommunications equipment is represented as being within a single customer's 
premises. However, this need not be the case, as the subscriber terminal 20 preferably 
5 supports either a single or a dual line, so that two subscriber lines could be supported 
by a single subscriber terminal 20. The subscriber terminal 20 can also be arranged 
to support analogue and digital telecommunications, for example analogue 
communications at 16, 32 or 64kbits/sec or digital communications in accordance with 
the ISDN BRA standard. 

10 Figure 3 is a schematic illustration of an example of a central terminal of the 

telecommimications system of Figure 1 . The common equipment rack 40 comprises 
a number of equipment shelves 42, 44, 46, including a RF Combiner and power amp 
shelf (RFC) 42, a Power Supply shelf (PS) 44 and a number of (in this example four) 
Modem Shelves (MS) 46. The RF combiner shelf 42 allows the four modem shelves 

15 46 to operate in parallel. It combines and amplifies the power of four transmit signals, 
each from a respective one of the four modem shelves, and amplifies and splits 
received signals four way so that separate signals may be passed to the respective 
modem shelves. The power supply shelf 44 provides a connection to the local power 
supply and fusing for the various components in the common equipment rack 40. A 

20 bidirectional connection extends between the RF combiner shelf 42 and the main 
central terminal antenna 52, typically an omnidirectional antenna, mounted on a central 
terminal mast 50. 

This example of a central terminal 10 is connected via a point-to-point 
microwave link to a location where an interface to the public switched telephone 

25 network 18, shown schematically in Figure 1, is made. As mentioned above, other 
types of connections (e.g., copper wires or optical fibres) can be used to link the 
central terminal 10 to the public switched telephone network 18. In this example the 
modem shelves are connected via lines 47 to a microwave terminal (MT) 48. A 
microwave link 49 extends from the microwave terminal 48 to a point-to-point 

30 microwave antenna 54 mounted on the mast 50 for a host connection to the public 
switched telephone network 18. 
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A personal computer, workstation or the like can be provided as a site 
controller 56 for supporting the central terminal 10, The site controller 56 can be 
connected to each modem shelf of the central terminal 10 via, for example, RS232 
connections 55. The site controller 56 can then provide support fimctions such as the 
5 localisation of faults, alarms and status and the configuring of the central terminal 10. 
A site controller 56 will typically support a single central terminal 10, although a 
plurality of site controllers 56 could be networked for supporting a pluralit>' of central 
terminals 10. 

As an alternative to the RS232 connections 55, which extend to a site controller 

10 56, data connections such as an X.25 links 57 (shown with dashed lines in Figure 3) 
could instead be provided from a pad 228 to a switching node 60 of an element 
manager (EM) 58. An element manager 58 can support a number of distributed 
central terminals 10 connected by respective connections to the switching node 60. 
The element manager 58 enables a potentially large number (e.g., up to, or more than 

15 100.0) of central terminals 10 to be integrated into a management network. The 
element manager 58 is based around a powerful workstation 62 and can include a 
number of computer terminals 64 for network engineers and control persormel. 

Figure 3 A illustrates various parts of a modem shelf 46. A transmit/receive RF 
unit (RFU - for example implemented on a card in the modem shelf) 66 generates the 

20 modulated transmit RF signals at medium power levels and recovers and amplifies the 
baseband RF signals for the subscriber terminals. The RF unit 66 is connected to an 
analogue card (AN) 68 which performs A-D/D-A conversions, baseband filtering and 
the vector summation of 1 5 transmitted signals from the modem cards (MCs) 70. The 
analogue unit 68 is connected to a number of (typically 1-8) modem cards 70. The 

25 modem cards perform the baseband signal processing of the transmit and receive 
signals to/from the subscriber terminals 20. This includes 1/2 rate convolution coding 
and X 16 spreading with CDMA codes on the transmit signals, and synchronisation 
recovery, de-spreading and error correction on the receive signals. Each modem card 
70 in the present example has two modems, each modem supporting one subscriber 

30 link (or two lines) to a subscriber terminal 20. Thus, with two modems per card and 
8 modems per modem shelf, each modem shelf could support 16 possible subscriber 
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links. However, in order to incorporate redundancy so that a modem may be 
substituted in a subscriber link when a fault occurs, only up to 15 subscriber links are 
preferably supported by a single modem shelf 46. The 16th modem is then used as 
a spare which can be switched in if a failure of one of the other 15 modems occurs. 
5 The modem cards 70 are connected to the tributary unit (TU) 74 which terminates the 
connection to the host public switched telephone network 18 (e.g., via one of the lines 
47) and handles the signalling of telephony information to, for example, up to 15 
subscriber terminals (each via a respective one of 15 of the 16 modems). 

The wireless telecommunications between a central terminal 10 and the 

10 subscriber terminals 20 could operate on various frequencies. Figure 4 illustrates one 
possible example of the frequencies which could be used. In the present example, the 
wireless telecommunication system is intended to operate in the 1.5-2.5GHz Band. 
In particular the present example is intended to operate in the Band defined by ITU-R 
(CCIR) Recommendation F.701 (2025-2110MHz, 2200-2290MHz). Figure 4 

1 5 illustrates the frequencies used for the uplink from the subscriber terminals 20 to the 
central terminal 10 and for the downlink from the central terminal 10 to the subscriber 
temiinals 20. It will be noted that 12 uplink and 12 downlink radio channels of 
3.5MH2 each are provided centred about 2155MHz. The spacing between the receive 
and transmit channels exceeds the required minimum spacing of 70MHz. 

20 In the present example, as mentioned above, each modem shelf will support 1 

frequency channel (i.e. one uplink frequency plus the corresponding downlink 
frequency). Up to 15 subscriber links may be supported on one frequency channel, 
as will be explained later. Thus, in the present embodiment, each central terminal 10 
can support 60 links, or 120 lines. 

25 Typically, the radio traffic from a particular central terminal 1 0 will extend into 

the area covered by a neighbouring central terminal 10. To avoid, or at least to 
reduce interference problems caused by adjoining areas, only a limited number of the 
available frequencies will be used by any given central terminal 10. 

Figure 5A illustrates one cellular type arrangement of the frequencies to 

30 mitigate interference problems between adjacent central terminals 10. In the 
arrangement illustrated in Figure 5A, the hatch lines for the cells 76 illustrate a 
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frequency set (FS) for the cells. By selecting three frequency sets (e.g., where: FSl 
= PL F4, F7, FIO; FS2 - F2, F5, F8, Fll; FS3 = F3, F6, F9, F12), and arranging 
that immediately adjacent cells do not use the same frequency set (see, for example, 
the arrangement shown in Figure 5A), it is possible to provide an array of fixed 
5 assignment omnidirectional cells where interference between nearby cells can be 
avoided. The transmitter power of each central terminal 10 is set such that 
transmissions do not extend as far as the nearest cell which is using the same 
frequency set. Thus each central terminal 1 0 can use the four frequency pairs (for the 
uplink and downlink, respectively) within its cell, each modem shelf in the central 

10 terminal 10 being associated with a respective RF channel (channel frequency pair). 

With each modem shelf supporting one channel frequency (with 1 5 subscriber 
links per channel frequency) and four modem shelves, each central terminal 10 will 
support 60 subscriber links (i.e., 120 lines). The 10 cell arrangement in Figure 5 A can 
therefore support up to 600 ISDN links or 1200 analogue lines, for example. Figure 

15 5B illustrates a cellular type arrangement employing sectored cells to mitigate 
problems between adjacent central terminals 10. As with Figure 5 A, the different type 
of hatch lines in Figure 5B illustrate different frequency sets. As in Figure 5 A, Figure 
5B represents three frequency sets (e.g., where: FSl = Fl, F4, F7, FIO; FS2 = F2, 
F5, F8, Fll; FS3 = F3, F6, F9, F12)- However, in Figure 53 the cells are sectored 

20 by using a sectored central terminal (SCT) 13 which includes three central terminals 
10, one for each sector SI, S2 and S3, with the transmissions for each of the three 
central terminals 10 being directed to the appropriate sector among SI, S2 and S3. 
This enables the number of subscribers per cell to be increased three fold, while still 
providing permanent fixed access for each subscriber terminal 20. 

25 A seven cell repeat pattern is used such that for a cell operating on a given 

frequency, all six adjacent cells operating on the same frequency are allowed unique 
PN codes. This prevents adjacent cells from inadvertently decoding data. 

As mentioned above, each channel frequency can support 15 subscriber links. 
In this example, this is achieved using by multiplexing signals using a Code Division 

30 Multiplexed Access (CDMA) technique. Figure 6 gives a schematic overview of 
CDMA encoding and decoding. 
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In order to encode a CDMA signal, base band signals, for example the user 
signals for each respective subscriber link, are encoded at 80-80N into a 
160ksymbols/sec baseband signal where each symbol represents 2 data bits (see, for 
example the signal represented at 81). This signal is then spread by a factor of 16 
5 using a respective Walsh pseudo random noise (PN) code spreading function 82-82N 
to generate signals at an effective chip rate of 2.56Msymbols/sec in 3.5MH2. The 
signals for respective subscriber links are then combined and converted to radio 
frequency (RJF) to give multiple user channel signals (e.g., 85) for transmission from 
the transmitting antenna 86. 

10 During transmission, a transmitted signal will be subjected to interference 

sources 88, including external interference 89 and interference from other channels 90. 
Accordingly, by the time the CDMA signal is received at the receiving antenna 91, the 
multiple user channel signals may be distorted as is represented at 93. 

In order to decode the signals for a given subscriber link from the received 

1 5 multiple user channel, a Walsh correlator 94-94N uses the same pseudo random noise 
(PN) code that was used for the encoding for each subscriber link to extract a signal 
(e.g, as represented at 95) for the respective received baseband signal 96-96N. It will 
be noted that the received signal will include some residual noise. However, unwanted 
noise can be removed using a low pass filter and signal processing. 

20 The key to CDMA is the application of orthogonal codes that allow the 

multiple user signals to be transmitted and received on the same frequency at the same 
time. Once the bit stream is orthogonally isolated using the Walsh codes, the signals 
for respective subscriber links do not interfere with each other. 

Walsh codes are a mathematical set of sequences that have the function of 

25 "orthonormality". In other words, if any Walsh code is multiplied by any other Walsh 
code, the results are zero. 

Figure 7 is a schematic diagram illustrating signal transmission processing 
stages 2is configured in a subscriber terminal 20 in the telecommunications system of 
Figure 1. The central terminal is also configured to perform equivalent signal 

30 transmission processing. In Figure 7, an analogue signal from one of a pair of 
telephones is passed via a two-wire interface 102 to a hybrid audio processing circuit 
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104 and then via a codec 106 to produce a digital signal into which an overhead 
channel including control information is inserted at 108. The resulting signal is 
processed by a convolutional encoder 110 before being passed to a spreader 116 to 
which the Rademacher- Walsh and PN codes are applied by a RW code generator 1 12 
5 and PN Code generator 114, respectively. The resulting signals are passed via a 
digital to analogue converter 118. The digital to analogue converter 1 18 shapes the 
digital samples into an analogue waveform and provides a stage of baseband power 
control. The signals are then passed to a low pass filter 120 to be modulated in a 
modulator 122. The modulated signal from the modulator 122 is mixed vAxh a signal 

10 generated by a voltage controlled oscillator 126 which is responsive to a synthesizer 
160. The output of the mixer 128 is then amplified in a low noise amplifier 130 
before being passed via a band pass filter 132. The output of the band pass filter 132. 
is further amplified in a further low noise amplifier 134, before being passed to power 
control circuitry 136. The output of the power control circuitry is further amplified 

15 in a further low noise amplifier 138 before being passed via a further band pass filter 
140 and transmitted from the transmission antenna 142. 

Figure 8 is a schematic diagram illustrating the equivalent signal reception 
processing stages as configured in a subscriber terminal 20 in the telecommunications 
system of Figure 1. The central terminal is also configured to perform equivalent 

20 signal reception processing. In Figure 8, signals received at a receiving antenna 150 
are passed via a band pass filter 152 before being amplified in a low noise amplifier 
1 54. The output of the amplifier 1 54 is then passed via a further band pass filter 156 
before being further amplified by a further low noise amplifier 158. The output of the 
amplifier 158 is then passed to a mixer 164 where it is mixed with a signal generated 

25 by a voltage controlled oscillator 162 which is responsive to a synthesizer 160. The 
output of the mixer 164 is then passed via the de-modiilator 166 and a low pass filter 
168 before being passed to an analogue to digital converter 170. The digital output 
of the A/D converter 170 is then passed to a correlator 178, to which the same 
Rademacher- Walsh and PN codes used during transmission are applied by a RW code 

30 generator 172 (corresponding to the RW code generator 1 12) and a PN code generator 
174 (corresponding to PN code generator 114), respectively. The output of the 
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correlator is applied to a Viterbi decoder 180. The output of the Viterbi decoder 180 
is then passed to an overhead extractor 182 for extracting the overhead channel 
information. The output of the overhead extractor 182 is then passed via a codec 184 
and a hybrid circuit 188 to a two wire interface 190 where the resulting analogue 
5 signals are passed to a selected telephone 192. 

At the subscriber terminal 20, a stage of automatic gain control is incorporated 
at the IF stage. The control signal is derived from the digital portion of the CDMA 
receiver using the output of a signal quality estimator to be described later. 

Figure 9 is a block diagram of downlink and uplink communication paths 

10 between the central terminal 10 and the subscriber terminal 20. A downlink 
communication path is established from the transmitter 200 in the central terminal 10 
to the receiver 202 in the subscriber terminal 20. An uplink communication path is 
established from the transmitter 204 in the subscriber terminal 20 to the receiver 206 
in the central terminal 10. Once the downlink and the uplink communication paths 

15 have been established in the wireless telecommunication system 1, telephone 
communication may occur between a first user 208 or a second user 210 of the 
subscriber terminal 20 and a user serviced through the central terminal 10 over a 
downlink signal 212 and an uplink signal 214. The downlink signal 212 is transmitted 
by the transmitter 200 of the central terminal 10 and received by the receiver 202 of 

20 the subscriber terminal 20. The uplink signal 2 1 4 is transmitted by the transmitter 204 
of the subscriber terminal 20 and received by the receiver 206 of the central terminal 
10. The downlink signal 212 and uplink signal 214 are transmitted as CDMA spread 
spectrum signals. 

The receiver 206 and the transmitter 200 within the central terminal 10 are 
25 synchronized to each other with respect to time and phase, and aligned as to 
information boundaries. In order to establish the downlink communication path, the 
receiver 202 in the subscriber terminal 20 should be synchronized to the transmitter 
200 in the central terminal 10. Synchronization occurs by performing an acquisition 
mode function and a tracking mode function on the downlink signal 212. Initially, the 
30 transmitter 200 of the central terminal 10 transmits the downlink signal 212. Figure 
10 shows the contents of the downlink signal 212. The downlink signal 212 includes 
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a code sequence signal 216 for the central terminal 10 combined with a frame 
information signal 218. The code sequence signal 216 is derived from a combination 
of a pseudo-random noise code signal 220 and a Rademacher- Walsh code signal 222. 
Although Figure 10 relates specifically to the makeup of the downlink signal, the 
5 uplink has the same makeup. 

Each receiver 202 of every subscriber terminal 20 serviced by a single central 
terminal 10 operate off of the same pseudo-random noise code signal as the central 
terminal 10. Each modem shelf 46 in the central terminal 10 supports one radio 
frequency channel and fifteen subscriber terminals 20, each subscriber terminal having 

10 a first user 208 and a second user 210. Each modem shelf 46 selects one of sixteen 
Rademacher- Walsh code signals 222, each Rademacher- Walsh code signal 222 
corresponding to a unique subscriber terminal 20. Thus, a specific subscriber terminal 
20 will have an identical code sequence signal 218 as the downlink signal 212 
transmitted by the central terminal 1 0 and destined for the sjDecific subscriber terminal 

15 20. 

The downlink signal 212 is received at the receiver 202 of the subscriber 
termincil 20. The receiver 202 compares its phase and code sequence to a phase and 
code sequence within the code sequence signal 216 of the downlink signal 212. The 
central terminal 10 is considered to have a master code sequence and subscriber 

20 terminal 20 is considered to have a slave code sequence. The receiver 202 
incrementally adjusts the phase of its slave code sequence to recognize a match to 
master code sequence and place the receiver 202 of the subscriber terminal 20 in phase 
with the transmitter 200 of the central terminal 10. The slave code sequence of the 
receiver 202 is not initially synchronized to the master code sequence of the 

25 transmitter 200 and the central terminal 10 due to the path delay between the central 
terminal 10 and the subscriber terminal 20. This path delay is caused by the 
geographical separation between the subscriber terminal 20 and the central terrninal 
10 and other environmental and technical factors affecting wireless transmission. 

When the downlink and the uplink communication paths are acquired, the 

30 wireless telecommunication system 1 enters the standby mode. In the standby mode, 
the transmitting power of the downlink and uplink transmitters are reduced by 12 
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decibels. This reduction in transmitting power minimizes the interference to other 
subscriber terminals while still maintaining synchronization. The transmit rate remains 
at the low rate level to allow exchange of control information between the central 
terminal 10 and the subscriber terminal 20 over the overhead chaimel 224. 
5 When either an incoming or outgoing call is detected, a message is sent from 

the originating terminal to the destination terminal indicating that the downlink and 
uplink conununication paths are required for the transmission of user traffic 
information. At this point, the wireless telecommunication system 1 enters into the 
traffic mode. During the traffic mode, the transmitting power of both the downlink 

1 0 and uplink communication paths is increased to the high power level and the transmit 
rate is increased to the high rate level of 160 kilobits per second to facilitate 
information transfer between originating and destination terminals. Upon detection of 
call termination, a message is sent from the terminating terminal to the other terminal 
indicating that the downlink and uplink conununication paths are no longer required. 

15 At this point, wireless telecommunication system 1 reenters the standby mode. Code 
synchronisation and frame alignment tracking is performed in both the standby mode 
and the traffic mode. 

Figure 1 1 shows the general contents of a frame information signal 218. The 
frame information signal 218 includes an overhead channel 224, a first user channel 

20 226, a second user channel 228, and a signalling channel 230 for each frame of 
information transported over downlink signal 212. The overhead chaimel 224 carries 
control information used to establish and maintain the downlink and uplink 
communication paths. The first user channel 226 is used to transfer traffic information 
to the first user 208. The second user channel 228 is used to transfer traffic 

25 information to the second user 210. The signalling channel 230 provides the 
signalling information to supervise operation of the subscriber terminal 20 telephony 
functions. The overhead channel 224 occupies 16 kilobits per second of a frame of 
information, the first user channel 226 occupies 64 kilobits per second of a frame of 
information, the second user channel 228 occupies 64 kilobits per second of a frame 

30 of information, and the signalling channel 230 occupies 16 kilobits per second of a 
frame of information. 
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Figure 12 shows how the overhead channel 224 is inserted into the data stream 
of the downlink signal 212. The data stream of the downlink signal 212 is partitioned 
into twenty bit subframes. Each twenty bit subframe has two ten bit sections. , A first 
ten bit section includes an overhead bit, a signalling bit, and eight first user bits. A 
5 second ten bit section includes an overhead bit, a signalling bit, and eight second user 
bits. This twenty bit subframe format is repeated throughout an entire four 
millisecond frame of information. Thus, an overhead bit occupies every tenth bit 
position of frame information in the data stream of the downlink signal 212. 

The overhead channel 224 includes eight byte fields - a frame alignment word 

10 232, a code synchronization signal 234, a power control signal 236, an operations and 
maintenance charmel signal 238, and four reserved byte fields 242. The frame 
alignment word 232 identifies the beginning of frame position for its corresponding 
frame of information. The code synchronization signal 234 provides information to 
control synchronization of the transmitter 204 in the subscriber terminal 20 to the 

15 receiver 206 in the central terminal 10. The power control signal 236 provides 

information to control transmitting power of the transmitter 204 in subscriber terminal ^ 
20. The operations and maintenance channel signal 238 provides status mformation 
with respect to the downlink and uplink communication paths and a path from the 
central terminal to the subscriber terminal on which the communication protocol which 

20 operates on the modem shelf between the shelf controller and the modem cards also 
extends. 

Figure 13 is a schematic top view, partially in section of an example of an 
integrated anterma forming the customer radio unit (CRU) of Figure 1 , 

Figure 13 illustrates a chassis member 450 located v^thin a radome 402. A 

25 vertically extending wall 416 of the chassis defines a rear wall for first and second 
resonant cavities 426 defined to the front of the wall 416. Part of one resonant cavity 
426, which is located in the right hand portion of the anterma (the lower portion of 
Figure 13) when viewed from the front (arrow A) is shown in Figure 13. The other 
resonant cavity (not shown) is located in the left hand portion of the anterma (the 

30 upper portion of Figure 13) when viewed from the front (arrow A). A wall (not 
shown) extends vertically (perpendicularly to the plane of Figure 13) and forwardly 
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(i.e. to the left in Figure 13) from the wall 416 to separate the first and second dished 
resonant cavities 416. 

The chassis member is preferably made of the same plastics material as the 
radome, although other plastics or other materials could be used. The forwardly 
5 facing surface of the vertically extending wall 416, the inwardly facing surfaces of the 
peripheral wall 419 and both sides of the horizontally extending wall 417 are 
preferably metallised, for example with a deposited layer of aluminium or an 
aluminium alloy for reflecting radio waves to define the resonant cavities. 

Part of the radome 402 is cut away in the lower pan of the Figure to show part 

10 of a microstrip radiator element 420 and patch re-radiator (reflector) 424. A stud 422 
extends from the microstrip 420 and through the wall 416 to couple radio energy 
though the wall 416. 

The chassis member 450 also has a rearwardly extending peripheral wall 451 
for defining a rear cavity 438 for containing electronic components on one or more 

15 printed circuit boards. In Figure 13, an RF board 428 having radio frequency circuitry 
430 is provided which, when inserted in cavity 438, cooperates with the stud 422 on 
the microstrip 420. Also shown is a modem board 432 having modem circuitry for 
processing received signals from and for providing transmission signals to the RF 
circuitry 430. The modem circuitry 434 is then connected via a drop cable 28 which 

20 passes through a gland 435 in the rear cover 414 to the power supply unit 30 shown 
in Figure 2. 

The rear side of the wall 416 and the insides of the peripheral wall 45 1, as well 
as the inside of the rear cover 414, can be metallised to provide electromagnetic 
shielding for the electronic components in the rear cavity 438. 

25 In this embodiment, the rear cover 414 has a peripheral portion 460 of plastics 

material and a central portion 458 formed of aluminium alloy with integral fins 456 
to form an integral heat sink. The provision of a heat sink enables heat to be 
dissipated from electronic components sealed within the integrated antenna units. A 
bracket 404 is secured to the heatsink by screws 464 although it could be formed 

30 integrally withe the aluminium portion 458 of the rear cover. An 'O'-ring seal 464 
seals the rear cover 460 to the radome when the cover is secured thereto by screws 
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466. The aluminium portion 458 can be screwed at locations 466 to the peripheral 
plastics portion and sealed using conventional silicon sealant materials. The inside of 
the plastics portion 460 of the cover preferably has an aluminium coating to reduce 
electromagnetic interference. 
5 In an alternative embodiment, the whole of the rear cover could be made of 

metal, for example, a cast aluminium alloy including the heat sink fms 456 and 
possibly the bracket 404. 

To increase the heat transfer from the electronic components to the heatsink, 
the heatsink can be provided with internal pedestals 454 for contacting the circuits, or 

10 the circuit boards, directly. Alternatively, or in addition, heat conductive foam 452 
can be used to couple the heat from the electronic components to the heat sink. This 
is particularly advantageous where a lot of heat is generated from the electronic 
components or when the antenna is used in warm environments, in order to avoid 
overheating of the components within the sealed unit. 

1 5 Figure 14 is a detailed block diagram of a communications controller including 

the receiver 202 and transmitter 204 in a subscriber terminal 20. The receiver 202 
receives the downlink signal 212 at an RF receive interface 250. The RF receive 
interface 250 separates the spread spectrum signal into I and Q signal components. 
The RF receive interface 250 band pass filters each of the I and Q signal components 

20 by removing portions above approximately half of the receiver 202 bandwidth of 3.5 
MegaHertZ- The RF receive interface 250 low pass filters the I and Q signal 
components to reject image frequencies and prevent signal aliasing. The I and Q 
signal components are placed into digital format by an analog to digital converter 252. 
The sampling frequency of the analog to digital converter 252 is four times the chip 

25 period, or 10.24 MegaHertz, with an eight bit resolution. 

Within the communications controller, the digital I and Q signal components 
are stepped to a rate of 5.12 MegaHertz by a down converter 254. A code generator 
and despreader 256 performs the synchronization acquisition and tracking functions 
previously described to synchronize the phase of the Rademacher- Walsh and pseudo- 

30 random noise code sequence of the receiver 202 to that of the downlink signal 212. 
A digital signal processor 258 controls the phase of the slave code sequence through 
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a code tracker 260 and a carrier tracker 262. An automatic gain control unit 264 
produces an automatic gain control signal to control the gain of RF receive interface 
250. The code generator and despreader 256 generates the I and Q 160 kilobits per 
second of frame information for further synchronization by a node sync interface 266 
under the control of a node sync logic unit 268. The node sync interface 266, through 
the node sync logic unit 268, deteraiines whether the I and Q channels should be 
swapped, as they may be received in four different ways. 

The Viterbi decoder 270 provides forward error correction on the I and Q 
charmels and generates an error corrected 160 kilobits per second data signal after a 
71 symbol delay. The error corrected signal is processed by a frame aligner and the 
extractor 272 determines frame alignment and extracts a power control signal 236, 
code synchronization 234, and an operations and maintenance channel signal 238. The 
frame aligner and extractor 272 also extracts a first user channel 226 and a second 
user channel 228 for traffic transmission towards a first user 208 and a second user 
210, and a signalling channel 230 for processing by high level data link controller 274 
and a microcontroller 276. The frame aligner and extractor 272 also provides alarm 
and error indications upon detecting a loss in frame alignment. A non-volatile random 
access memory 278 stores system parameter information for subsequent insertion 
through an arbitrator 280 in the event of link loss in order to facilitate link 
reestablishment. The arbitrator 280 also provides an interface between the digital 
signal processor 258 and the microcontroller 276. 

In the transmit direction, a frame inserter 282 receives first user traffic and 
second user traffic from the first user 208 and the second user 210, signalling channel 
230 information from the high level data link controller 274, and operations and 
maintenance channel 238 information from the microcontroller 276. Frame inserter 
generates the frame information signal 218 for uplink signal 214 for processing by a 
convolutional encoder 284. The convolutional encoder 284 doubles the data rate of 
the frame information signal 21 8 to provide forward error correction. A spreader 286 
splits the 320 kilobits per second signal of the convolutional encoder 284 into two 160 
kilobits per second I and Q signals and exclusively ORs these signals with the 
spreading sequence generated by a code generator 288 in response to a system clock 
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generated by the clock generator 290 as adjusted by the code synchronization signal 
234. The code generator 288 generates one of sixteen Rademacher- Walsh functions 
exclusive ORed with a pseudo-random sequence having a pattern length of 256 with 
a chip rate of 2.56 MegaHertz. The pseudo-random sequence should match that of 
5 central terminal 10, but is adjustable under software control to provide reliable 
rejection of signals from other bands or other cells. 

The spreader 286 of the communications controller supplies the I and Q signals 
to an analog transmitter 290. The analog transmitter 290 produces pulsed I and Q 
signals for an RF transmit interface 292. Transmit power is generated by first 

10 establishing a control voltage from a digital to analog converter in response to the 
power control signal 236 extracted from the overhead channel 224. This control 
voltage is applied to the power control inputs of analog transmitter 290 and RF 
transmit interface 292. Power control of 35 decibels is obtainable in both the analog 
transmitter 290 and the Rp transmit interface 292. The RF transmit interface 292 

15 includes a step attenuator that provides 2 decibel steps of attenuation over a 30 decibel 
range. This attenuator is used to switch between high and low power levels. On 
power up, maximum attenuation is selected to minimize the transmitting power of 
transmitter 204. 

In the present hardware implementation of the CDMA modem illustrated in 
20 Figure 14 the followdng major hardware components are used. An ASIC (STEL2001) 
implements the spread spectrum demodulator and the spreader 286. An FPGA (Field 
Programmable Gate Array) is used to implement transmit and receive signal formatting 
and other "glue" logic such as the functions of the code generator and despreader 256 
and the code generator 288. The digital signal processor (DSP) 258 controls spread 
25 spectrum acquisition and tracking. The H8 microcontroller 276 processes the OMC 
and signalling channels. It also provides the interface with the power supply unit. A 
further function of the microcontroller 276 is the programming of the radio frequency 
synthesizers. 

Figuires 15 to 18 illustrates various aspects of the hardware and operation of 
30 the communications controller, that is the modem interface board, for explaining the 
programming of the devices for configuring the subscriber terminal. 
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Figure 15 illustrates the microcontroller 276, a watchdog circuit 302, a cr\'stal 
304, an Erasable Programmable Logic Device (EPLD) 306, a dual port RAM 308, first 
and second flash memories 310 and 312, the FPGA 314 and the Digital Signal 
Processor (DSP) 258. Figure 16 illustrates a reset state machine 316, first and second 
5 8 bit registers 318 and 320, an address buffer 322, a selector circuit 326, a gate 328, 
an SRAM control circuit 330, an SLIC latch 324, two one bit address registers 332 
and 334 and an 8 bit address register 336. Figure 17 illustrates different memor>'. 
mappings and Figure 18 illustrates various states of the state machine 316. 

At initialisation, for example following a reset, the communications controller, 

10 that is the modem interface board, powers up. At this time the microcontroller 278 
is caused to configure the FPGA 314, load the dual-port RAM 308 with DSP code and 
starts the DSP 258 by removing its reset. There are two flash memor>' chips 310 and 
312, one of which holds the active code the other of which holds the code down- 
loaded from the control terminal. 

15 The reset state machine 316 determines which flash memory 310 or 312 

contains the active code. The active code is the code that the microcontroller 276 
executes. The other flash memory 312 or 310 holds the shadow code (i.e. code that 
is down-loaded from the central terminal). 

With reference to Figure 18, on powering up, the microcontroller 276 executes 

20 from flash memory 0, 310 state "run_flashO", 370. If however, the flash memory 1, 
312 contains the active code, which is determined by reading the version number of 
the code stored in the flash memories 3 10 and 3 12, then the microcontroller 276 stops 
strobing the watchdog circuit 302, which forces a reset state and the state machine 316 
moves to state "run_flashr', 372. This selects flash memor>' 1, 312 as the active flash 

25 memory. Then, when the reset signal goes high, the code is executed from the flash 
memory 1, 312. 

Accordingly, the state machine 316 has the effect of restricting power-on boot 
up to a single flash memory assuming that this is present and operational, regardless 
of the previous operating scenario. In order to achieve this operation, a small section 
30 of the code in the flash memor>' must remain unchanged to ensure reliabil:r>' in the 
event of a down-load failure. Figure 19 illustrates the manner in which this is 
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achieved. In particular the boot-strap and loader code (BSL) 6 10 in flash memory 3 1 0 
is arranged to be constant and never to change, whereas the boot-strap and loader code 
(BSL) 612 in flash memory 312 can be changed. Both the main code 614 in the flash 
memory 3 1 0 and the main code 616 in the flash memory 3 1 2 can be changed, the 
5 main code 614 in the flash memory 310 being that which is normally executed flrst 
after power-up. Accordingly, the code held in each of the flash memories is structured 
into a boot-strap and loader code and a separate main code section. These sections 
will be described later. 

The reset state machine 316 is arranged to be able to recover from the 

10 following scenarios: 

1) Flash memory 0, 310 has been corrupted. UTien on power up, the flash 
memory 0, 310 is selected and the code does not execute, a watchdog reset occurs. 
The state machine 316 then moves on to state "run flashl" 372 and selects flash 
memor>' 1, 312 as the active flash memor\'. 

1 5 2) Flash memory 1,312 has been corrupted but has a higher version number than 
flash memor>' 0, 310. When, on power up, code is run from flash memory 0, but is 
determined that flash memory 1, 312 has a higher version number, flash memory 1 
will be checksumed by flash 0 and this v^ill fail, therefore it will not be executed. The 
state machine 316 then moves to state "run_flashO_fault" 374. The microcontroller 

20 software reads the status of the state machine from sel_active_flash__addr (see Figure 
16), and it identifies that there is a fault, ignores the version numbers and continues 
to run from flash memory 0, 310. Only if the checksum of the failed code is still 
correct will the above scenario be run through. 

Sel_active_flash_addr returns the following values: 

25 sel_active_flash_addr = OFlash memory 0 Active 
sel_active_flaLsh_addr = 1 Flash memory 1 Active 

sel_aciive_flash_addr 2Flash memory 0 Active, following a warm reboot. 

In practice, there is no such state as a fault state since the two code banks can 
be toggled between indefinitely to down-load new or execute old code. 
30 On power up the RESETN line from the watchdog chip (see Figures 1 5 and 

16) goes low, the clock signals to the microcontroller 276 is driven by a 18.432 Mhz 
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crystal 304 and the microcontroller 276 is reset. Flash memory 0, 310 is selected by 
default and boot code is executed. A series of bytes representing the version number 
in flash memory 0 and 1 indicate which is the active flash memor>', namely the one 
with the higher version number. If flash memory 0, 3 10 contains the active code then 
5 the microcontroller down-loads code to the FPGA and DSP and jumps to the main 
program. 

Any software down-loaded by wireless from the central terminal would be 
loaded into the shadow flash memory- L 312 if flash memory 0, 310 is active. The 
boot sections of flash memory 0, 310 is protected so that even if there is a problem 
10 during down-load the system can recover. Sectors of the flash memory can be pre- 
loaded. Indeed this is the case with the boot section of flash memory 0, 310. 

A soft reset is performed during loading of the FPGA 314 and DSP 258 using 
the active code which has been selected, then removed the soft reset to the DSP 258 
by writing a T to the EPLD 306 store soft_reset_addr. The soft reset output 
15 RESETN_S then powers up low. 

The programming of the FPGA device 314 by the microcontroller 276 occurs 
when the microcontroller 276 reads data from the active flash memory 310 or 312. 
It programs the FPGA device 314 as follows: 
Initialise nCONFIG = 0. 
20 1) Drive nCONFIG low to high to start programming. 

2) Wait for nSTATUS to go high. 

3) Read Data from the flash memor>' and write the data to prog_flash memory _addr. 

4) The EPLD 306 sets WAIT active and drives DCLK high/low eight times. The data 
remains stable on the data bus and 8 bits are serialised in the FPGA device 314. The 

25 EPLD 306 then sets WAIT inactive. 

5) If nSTATUS goes low, there was an error and the process return to step 1 (i.e. 
reload) otherwise the process goes to step 3. 

For the FPGA 81188 24kbytes are loaded and when programming is complete 
CONF_DONE goes high. 
30 The microcontroller can only address 64k of external memory (16 addr lines). 

Accordingly, on power up it can access 64k of flash memory 0. To access page 1 of 
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flash memory 0 it needs to do the following: 

1 ) Write the MSB of the address it wants to access to page_msb_addr. 

2) Write the LSB of the address it wants to access to page_lsb_addr. 

3) Read/write to address active__pagel_addr, the EPLD generates the appropriate 
5 address and chip selects to access page 1 of flash memory 0. 

If it is necessary to access page 0 of flash memory 1, the address is written as 
in steps 1 and 2 and then read/write to address shadowjpageO_addr. To access page 
1 of flash memory 1 , the address is written as in steps 1 and 2 and then read/write to 
address shadow jpage 1 _addr. 
10 If the flash memory 1,310 holds the active code, then the address map needs 

to be swapped by writing a T to sel_active_flash_addr and forcing a microcontroller 
276 reset. 

The programming of the DSP 258 by the microcontroller 276 occurs on power 
up with resetn_s low, which is used to reset the DSP 258, This forces the DSP 

15 address, data and control signals into a high-impedance state. The microcontroller 
then writes the DSP program data to the 16-bit x 4K dual-port RAM 308 with even 
address as the lower 8-bits, odd address as the upper 8-bits. The dual-port RAM 308 
is mapped into the microcontroller address map as shown in Figure 17. 

It should be noted that before the DSP 258 is reset the microcontroller 276 sees 

20 8K of RAM and after reset this is mapped into the microcontroller address space. 5 1 2 
Bytes of RAM are mapped into the microcontroller address space. The 512 Bytes of 
RAM are mapped to AOO-AFF of the dual port RAM 308, leaving 3.5K for the DSP 
code. 

The microcontroller 276 writes the code from the appropriate flash memory 
25 into the dual-port RAM 308, reads the RAM to do a checksum and then write T to 
soft_reset_addr. The DSP 258 is reset and executes code from the dual-port RAM 
308. 

Figures 20 to 32 describe various aspects of the communications protocol and 
aspects of the operation of the software down-load facility of the subscriber terminal 
30 of the wireless communications system. In the following description, reference will 
be made to the software down-load for configuring the subscriber terminal, and in 
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particular its commxinications controller (modem card) of Figure 14, and to other 
devices supported thereby. However, an important aspect of the arrangements to be 
described is that software could be down-loaded for other field replaceable units 
(FRUs) in the same or a similar manner, thus permitting code re-use, 
5 As mentioned above with reference to Figure 19, the code in the flash 

memories 310 and 312 is split into two distinct sections, the boot-strap and loader 
section and the main code section. 

The boot strap and loader code section forms an independent executable 
segment which resides in the boot areas 610/612 of the flash memories 310/312. This 

10 segment initialises the ports of the microcontroller 276 and loads any code stored in 
the flash memory for any other device supported by the communications controller. 
The boot-strap is a generic design suitable for all field replaceable units, all service 
functions which are device specific being externalised. Figure 20 illustrates an 
instance of the boot-strap. As represented in Figure 20, the externalised functions are 

15 placed in a separate module and registered with the boot-strap by calling the 
BOOT_Init service. The externalised services are illustrated in Table 1 below. Note 
that the services may be empty modules if no processing is required. 
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void FRU_BootInit(void) 


Servnce to initialise the microcontroller 
276 ports and perform any other FRU 
specific initialisation required 


void FRU_BgTasks(void) 


Service to be called periodically by the 
boot-strap to keep the FRU alive 


unsigned char FRU_ReadFlashByte 
(unsigned long Address) 


Service to read a byte from the FRU 
flash memory 


void FRU_WriteFlashByte(unsigned 
long Address, unsigned char Data) 


Service to write a byte to the FRU 
flash memory 


void FRU_LoadCode(void) 


Service to load code from the flash 
memory to other devices on the FRU 



Table 1 

As mentioned above, the software version is checked by the state machine 316. 
The software version is represented by an 8-bit number, the most significant nibble 

15 specifying the major revision number and the least significant nibble specifying the 
minor revision number. Major revisions are interpreted as alpha characters for display 
purposes at the site management processor 58 or site controller 56 at a central terminal 
10 (see Figure 3). The major revisions typically reflect i change in firmware part 
number and the minor revisions backwardly compatible upgrades for a particular 

20 firmware part number, 

A revision of down-loaded code is only executed under command from a 
central terminal. In order to incorporate the version number, a reset indication for the 
communications controller of the subscriber terminal includes two bytes to report the 
current and background version numbers to the central terminal. 

25 Once the externalised services (parameters) have been registered, the 

BOOT_FindLoader of the boot-strap then performs software version checking. In 
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.other words it determine which code should be executed by comparing version 
numbers and checking a code checksum. 

The state machines describing these operations for both a cold and warm start 
are shown in Figxires 21 and 22, respectively. If both versions of the code appear to 
5 be invalid, the state machines will continuously toggle between the two code banks. 
It should be noted in the state diagrams forming Figures 22 to 30, that the states are 
indicated in the boxes, and the state transitions are described with the event causing 
a state transition indicated above the horizontal line and the resulting action indicated 
below the horizontal line. 

10 The boot-strap is designed to provide an option of working with a single flash 

memory, although in the preferred embodiment two flash memories are provided. 

Where a single flash memory is provided in the boot socket (i.e. the first 
accessed flash memory), the boot strap compares the version numbers of the two 
sockets, reading Sffff as the number for the unpopulated socket. As a result, the 

15 checksum for the unpopulated socket fails so that the flash memory is executed. 

Where a single flash is in the non-boot socket, the watchdog starts the 
hardware reset state machine because no code is executed, which then goes through 
the sequence described in the paragraph above. 

When the correct boot-strap has been executed, an assembly level jump is made 

20 to the start of the main code. The jump point is defined in the same module as the 
FRU services described above. The jump is performed by modifying an exit function 
provided by the microcontroller compiler. This function noraially resides in the 
CSTARTUP module of the compiler and is compiled into a library. A separate exit 
module is created which overwrites the exit module in a copy of the library. This 

25 approach reduces the impact of any compiler upgrades which require a change to 
CSTARTUP module. When the jump is made from the bootstrap, this releases all 
system resources, including memory, so that these are available for the main code. 
The boot-strap code is not re-entered until the next reset occurs. 

A software downn-load protocol employs a protocol stack which is designed to 

30 link to either a protocol stack used for the main radio link communications protocol 
or the overhead management chaimel (OMC) protocol stack used for operations and 
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maintenance messaging. In other words, the communications protocol for software 
down-load is intended to make use of whatever existing messaging protocol is 
available between the central terminal and the subscriber terminal. 

Figure 23 is a schematic block diagram illustrating an example of various 
5 control protocols used for the transmission of control information between different 
parts of an example of a telecommunications system. It should be noted that Figure 
23 is directed to the control signal paths, and accordingly, the telephone call signal 
paths are not included. Many of the features of Figure 23 have already been described 
above, and in this case the same reference numerals are used as before. Accordingly, 

10 these features will not be described again in detail. 

A first protocol, called the Sub-system Management Processor (SMP) protocol, 
is used for communications between the shelf controller 72 and a site controller 56, 
or element manager 58, via lines 59 and 55, or 59 and 57, respectively. The first 
protocol is a balanced protocol with either party to a communication being able to 

1 5 initiate an exchange of information. The first protocol and the types of message which 
can be sent will be described in more detail below. As mentioned above, the shelf 
controller 72 is provided with an RS232 serial output for connection to a site 
controller 56. Accordingly, if a coimection is provided instead to an element 
controller 62, represented schematically by the switch 727, a pad 728 for connection 

20 to an X.25 line, or the like, is used to convert between RS232 format and X.25 
format. 

A second protocol, called the Radio Link Termination (RLT) protocol, is used 
for passing control and data messages via the control 712 and data 713 buses on the 
modem shelf. In addition, it should be noted that the same protocol is valid on the 
25 radio link 726 between the antenna 52 of the central terminal and the subscriber 
terminal(s) 20. 

The RLT protocol is an unbalanced protocol vnth the master communications 
interface 73 in the shelf controller 72 acting as a busmaster (M) and the slave 
communications interfaces 69, 71 and 75 on the analogue card, the modem cards and 
30 the tributary unit acting as slaves. In a preferred embodiment the master 
communications processing functions in the shelf controller are shared between a 
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,68000 series microprocessor, which Will hereafter be referred to as the master client, 
and a Hitachi H8 microcontroller, which will hereinafter be referred to as the master 
server. The slave communications processing functions in the tributary unit are 
similarly shared between a 68000 series microprocessor and a Hitachi H8 
5 microcontroller. In the other slave units, including the communications controller of 
the subscriber terminal, the slave communications processing functions are performed 
in a Hitachi H8 microcontroller, which will hereinafter be referred to as the slave 
server. 

The RLT communications protocol is based on three layers. Figure 24 is a 
10 schematic representation of this layered protocol structure. 

The master communications end point functions perfomied at the third layer 
include the following functions. 

- A master initialisation service process (M-INIT) sets up the master client part of the 
master communications end-point in the shelf controller. This ser\'ice call must be 

1 5 executed before the other communications functions can be performed. 

- A master initialisation poll process (M-POLL) initialises the master server part of the 
master communications end-point. This service process must be called before the 
following functions can be performed. 

- A master establish process (M-EST) establishes a connection over the bus from the 
20 master to a slave in response to a slave address referencing a slave board. Messages 

can be sent and received once a cormection has been established. 

- A master send process (M-SEND) takes a message and sends it to a nominated slave 
over the bus as long as the connection to the slave has already been established. 

- A master receive process (M-REC) receives a message from a slave to be passed, for 
25 example, to a management processor. 

- A master release process (M-REL) releases a connection to a nominated slave 
preventing further send and receive functions from being performed. 

- A master select process (M-SEL) provides an addressing mechanism for the master 
to select one of the slaves with which to communicate. 

30 The slave communications end-point functions performed at the third layer 

include the following functions. 
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- A slave initialisation service process (S-INIT) initialises the slave communications 
end-point. This service function must be called before any of the other functions can 
be performed. 

- A slave send process (S-SEND) takes a message and sends it to the master, as long 
5 as the master has akeady established a connection to the slave. 

- A slave receive process (S-REC)function receives a message from the master to be 
passed, for example, to a net\\'ork service element addressed by the message. 

The master communications end-point M includes the following functional 
components. 

10 - A master VM (virtual machine) component (MVM) provides a set of services for the 
management of storage to dynamically allocate memory for buffers, queues, 
semaphores and timers. 

- A master layer 1 component (ML I) provides low level communication primitives for 
supporting byte transfer from the master server using a serial communication interface. 

15 - A master status list component (MSL) holds the status of each link from the master 
to one of the slaves. This is updated when a connection is made, broken or released. 

- A master retry count component (MRC) tracks the number of retires attempted in 
master to slave layer 2 communications. If this exceeds the limits for layer 2, the 
master breaks the connection with the slave. 

20 The slave communications end-point M includes substantially the same 

functional components as the master. 

The master layer 1 component (MLl) provides the following level 1 functions. 

- A master layer 1 initialisation process initialises the layer 1 communications system. 
No layer 1 communications can take place until this process has been invoked. 

25 - A master layer 1 byte-output process outputs a byte out of a serial communications 
port and waits for an acknowledgement from the receiver. If no acknowledgement is 
forthcomings then a failure is registered. 

- A master layer 1 data-out process is similar to the byte output process except that 
more than one byte can be transferred. 

30 - A master layer 1 address-out process is similar to the byte output process except that 
the source byte is output with a bit set to indicate that this relates to a multiprocessor 
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address rather than a data byte. 

- A master layer 1 data-in process waits for a specified number of bytes to be 
received on the communications port. If less than the required number of bytes is 
received, then a failure is registered. 

5 The master VM component (MVM) provides the following fimctions:- 

- A master VM initialisation process initialises the master VM component. This must 
be called before any other VM service. 

- A master VM get-message process removes a message from one of the queues held 
by the VM component. 

10 - A master VM put-message process places a message on one of the queues held by 
the VM component. 

- A master VM queue-full process indicates whether a selected queue is full. 

- A master VM get-buffer process allows a buffer to be requested from a buffer pool 
held by the VM component. 

15 - A master VM give-buffer process allows a buffer requested by the get-buffer process 
to be returned to the pool. 

- A master VM get-semaphore process allows a semaphore held by the VM component 
to be set. 

- A master VM give-semaphore process allows a semaphore set by the get-semaphore 
20 process to be cleared. 

- A master VM set-timer process sets a time-out period for one of the timers held by 
the master VM component. A flag is set by the master VM component when the 
timer expires. 

- A master VM add-timer function process registers an application function with the 
25 master VM component to be called at a particular time. 

The master and the slaves both use VM components to provide buffers, queues, 
semaphores and timers in order to permit the transfer of messages. 

Examples of operation of the RLT communications protocol are described in 
UK patent application 95108780.0, filed 2 June 1995, the contents of which are 
30 incorporated herein by reference. It is on the RLT protocol that the software down- 
load protocol resides in the present embodiment of the invention. However, it should 
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be noted that the details of the RLT protocol are not essential to the present invention, 
as any other protocol for the transmission of messages could be used to support the 
present software down-load protocol. 

The software down-load protocol is a master slave arrangement, the master 
5 residing on the shelf controller (which forms a communication controller) at the 
central terminal and the slave residing on the modem card (which forms a 
communications controller) at the subscriber terminal. Each packet of the protocol can 
use multiple packets in the underlying protocol Each message received is made up 
of component parts which are interpreted by the appropriate layer of the protocol. In 

10 a particular example, only consistently valid messages are passed down the stack to 
the lower layers. Similarly, each layer is responsible for constructing its own segment 
of the response/outgoing messages. 

Each layer is responsible for management of its own sequence numbers, 
including out of sequence handling, retry mechanisms, and error reporting. All retry 

15 mechanisms and time-outs are driven by the protocol master (i.e. at the central 
terminal 10). Each layer only reports negative events to the layer above, thus reducing 
the internal communications overhead. 

Figure 25 is a schematic representation of the virtual flow of messages between 
the corresponding master and slave layers, with "SC" representing the shelf controller, 

20 at the central terminal 1 0 and "FRU" representing a field replaceable unit, for example 
the communications controller at the subscriber terminal 20. It can be seen from the 
representation in Figure 25 that each layer in the central terminal has its counterpart 
in the subscriber terminal. Each pair of layers operates in a master-slave mode, with 
the layers in the central terminal effectively acting as masters. 

25 Figure 26 is a schematic representation of the actual message flow contributed 

by the protocol layers when a message is constructed, or assembled, at the shelf 
controller (SC) in the central terminal and then disassembled at the communications 
controller (FRU) in the subscriber terminal. It can be seen from Figure 26 that the 
received messages effectively move down the protocol from a top, session 

30 management level via a block management level to a packet management level. At 
each level checks are made on respective sequence numbers for each layer to verify 



. that messages are not received out of sequence in a manner indicative of a fault, 
noting that some messages may be out of sequence without there being a fault. 

The shelf controller at the central terminal handles down-load requests from 
the site management processor or site controller. These are converted into FRU 
5 session requests. The shelf controller implements the various layers of the protocol. 
A session management layer generates a unique session number which must be used 
for all subsequent communication during a session. The session layer is responsible 
for managing the session, ensuring the requisite number of blocks are transferred, 
querying the current session stams when communications with the FRU are 
10 temporarily lost and terminating the session on completion. 

Figure 27 illustrates a layer 4 state machine implemented at the shelf controller. 
The various transitions indicated in the central terminal session state machine in Figure 
27 are, it is believed, self-explanatory and accordingly they will not be described in 
detail. However, it is to be noted that the transition from the idle state to the 
15 send_next_block state occurs in response to a new session request from the site 
controller, or the site management processor. A new session number is set for the new 
session and this is used for all messages sent during the session. The effect of the 
send_next_block state is to start the central terminal block layer state machine 
illustrated in Figure 29. On confirmation from the block layer state machine that the 
20 block has been transmitted successfully, the state machine either loops back to the 
send_next_block state if the session is incomplete and more blocks are to be sent, or 
moves to the request session end state. Other transitions which are effective in various 
error conditions are indicated in Figure 27 including FRU_Response failed, which can 
occur, for example, when the session sequence number is in error, and various session 
25 request queries. 

Figure 28 illustrates a layer 4 state machine implemented at the FRU for 
handling the session and session query requests from the shelf controller, including 
various error transitions, which, it is believed, are clear from Figure 28. 

By monitoring the session number for received messages in layer 4, it is 
30 possible for multiple session to occur simultaneously. 

Figure 29 illustrates a layer 3 state machine implemented at the shelf controller 
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for initiating transfer of a block (each block consists of a number of packets) when 
requested by the session layer (L4), ensuring the requisite number of packets have 
been successfully transferred and terminating the block transfer when the block is 
complete. In response to a layer 4 block_send request, a request for a new block is 
5 sent from the central teraiinal block management layer 3 to the subscriber terminal. 

Figure 30 illustrates a layer 3 state machine implemented at the FRU for 
managing the receipt of blocks and erasing the appropriate memory sector. 

The subscriber terminal block management layer 3 generates a unique block 
sequence number in response to a block send request from the central terminal block 
10 management layer 3 which must be used by the central terminad block management 
layer -3 after the initial packet transfer. This prevents out of sequence stale packets 
being incorrectly interpreted and allows packets to be sent out of sequence without 
ambiguity at the subscriber terminal. After erasing appropriate sectors in memory, the 
subscriber terminal block management layer 3 sends a response to the central terminal 
1 5 layer 3, in response to which the central terminal layer 3 loops at the send_next_packet 
state imtil all packets for the block have been sent. Figure 29 and 30 indicate various 
block management transitions including various error transitions, which, it is believed, 
are clear from Figure 28. 

Figure 3 1 illustrates a layer 2 state machine implemented at the shelf controller 
20 ' and sitting on top of protocol which is used for the main radio link communications 
(e.g. the RLT protocol as described above). Alternatively, this could be arranged to 
sit on top of a protocol used for the operations and management channel (OMC). This 
layer 2 protocol forms the software down-load protocol master dealing with individual 
packets of data. A single packet may be made up multiple messages. An 
25 acknowledgement is expected for each packet. In response to a layer 3 send_packet 
event a packet number is issued by the central terminal packet management layer 2 
and this is used for the messages relating to that packet, where one packet is split 
between messages. However, a single message can be used for sending a packet in 
some cases. The packet number is sequentially adjusted (e.g. incremented) for each 
30 packet to be sent, starting at the begiiming of a block and then restarted for the next 
block. This enables packets to be sent out of sequence, if required. 
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Figure 32 illustrates a layer 2 state machine implemented at the FRU and 
sitting on top of protocol which is used to support communications with the central 
terminal. This provides the slave end of the master-slave software down-load protocol 
dealing with individual packets of data, which may be composed of several protocol 
5 messages. Each packet is acknowledged when complete by means of a response 
message sent from the packet layer 2 via the message layer 1. 

A message management layer 1 at the central terminal generates a message 
sequentially adjusted (e.g., incremented) number for each message for a packet where 
the packet is spread over more than one message. By a message is meant the 
10 underlying protocol unit of transfer. 

As can be seen from the state machines illustrated in Figures 27-32, each layer 
is responsible for managing its own sequence (i.e. session, block, packet, etc.) number 
and reporting a failure at the master (i.e. the central terminal in the present case) if an 
error is detected. 

15 Figure 33 illustrates three types of messages, A, B and C used for transmitting 

dat from the master to the slave. Types A, B and C corresponds respectively to the 
commencement of the session, a block and a packet. Each type can carry data for all 
types which occur at lower levels in the protocol stack. The packet checksum can be 
replaced by a combined "more marker" and message sequence number allowing a 

20 packet to be split into several messages. The number of bytes for a packet is then 
replaced by a message sequence number in a continuation packet. Figure 34 
represents a response message which is sent for each complete packet delivered 
(including packets of size 0 bytes) This shows an error if any layer of the protocol 
has failed. 

25 In the manner described and using the protocol structure described above 

software is down-loaded from the central terminal, is stored in an appropriate one of 
the flash memories 310 and 312. The subscriber terminal can then execute this 
software. 

Thus there has been described a protocol number scheme which allows 
30 communication to be periodically broken and re-established during a down-load 
session without re-starting the session. Multiple sessions can be managed by the 
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master. 

With the described protocol, code down-load does not detrimentally effect the 
performance of either the central terminal or the subscriber terminal. In particular, by 
passing the software via the control connmunications protocol, telephone calls may be 
5 made during software down-load. 

The session, block and packet numbering scheme described herein allows out 
of sequence message transmission and response. It also allows reliable recovery when 
a subscriber terminal is being re-powered or replaced and subsequently receives out 
of date packets. 

10 The use of the boot-strap enables identical code to be used for any number of 

field replaceable units. A set of external services (functions) can be registered with 
the boot-strap on initialisation, which services describe how to initialise the field 
replaceable unit, to read and write in the memory used and any further data required. 
On completion the boot-strap relinquishes all memor> including any stacks before the 

15 main code is executed. This provides for maximum code re-use, new code for each 
field replaceable unit flash memory limited to hardware specific low level functions 
which can be defined in a single file. 

Thus, a minimal device-independent boot-strap with device specific external 
service parameters provides a common operating environment can be provided for 

20 different pieces of equipment. This allows great flexibility for accommodating 
hardware and software changes and facilitates the down-loading of software upgrades 
to a range of devices. The boot-strap is preferably provided with a set of services 
describing how to initialise the hardware, read from the non-volatile memory (flash) 
and optionally load ancillary devices and perform keep-alive functions. A write 

25 function can also be provided. The services are passed to the boot-strap when it is 
initialised. (These services are physically located in the flash boot-strap area). 

The boot-strap provides a device independent state machine which controls the 
version checking, software integrity checking (checksum) and ancillary device 
configuration (loading), the latter being optional. The boot-strap then terminates itself, 

30 relinquishing all resources and passing conu-ol to the main code. The boot strap can 
be considered as an object which knows what to do and when to do it, but does not 
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possess all the details about how to interface with the hsLrdware. The service 
registration provision provides this information. 

The code down-load protocol layers (in the preferred embodiment configured 
as a master and slave) are device independent. The protocol stack, including the 
5 message transfer layer, can be placed on any field replaceable unit (FRU) and will thus 
provide all the state machines and message passing mechanisms required to support 
a code down-load session. The protocol stack(s) are provided with a set of hardware 
specific services describing how to initialise the hardware (for example including 
hardware timers), how to read and write a byte for hardware transmission, (optionally 

10 how to flush the memory) and also how to read and write to the non-volatile memory. 
Additional services describing how to erase non-volatile memory, and re-synchronise 
hardware and read hardware timers may also be provided. Thus, the concept can be 
compared to that for the boot-strap but this is a distinct and separate piece of code. 
The protocol slave will reside in the "main code" area with the hardware specific 

15 "main code" functionalitj\ 

Although a particular embodiment has been described herein, it will be 
appreciated that the invention is not limited thereto and that many modifications and 
additions thereto may be made within the scope of the invention. 

For example, although in the embodiment described above, a FPGA circuit is 

20 used, in alternative embodiments, an ASIC could be used instead. 
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CLAIMS 

1 . A subscriber station for the wireless connection of user telecommunications 
equipment to a remote central station of a wireless telecommunications system, said 

5 subscriber station comprising a transmitter/receiver for wireless communication with 
said central station, at least one telephone line for connection to subscriber 
telecommunications equipment and a communications controller connected between 
said transmitter/receiver and said telephone line for processing signals for transmission 
and/or received signals, said subscriber station being configurable in response to 
10 wireless programming signals representative of control code down-loaded from said 
central station. 

2. A subscriber station according to Claim 1, wherein said communications 
controller comprises one or more memories loadable with control code down-loaded 

15 from said central station and a processor arranged to execute said control code for 
configuring said subscriber station. 

3. A subscriber station according to Claim 2, comprising two memories for 
storing control code, wherein said communications controller is arranged to store 

20 successive updates of control code received from said central station alternately in said 
control memories, each update has an associated version number and said processor 
is arranged to execute said control code having the most recent valid version number. 

4. A subscriber station according to Claim 3, comprising a reset state machine 
25 responding to a reset state to determine which memory contains the control code 

having the most recent valid version number. 

5. A subscriber station according to Claim 4, wherein each said memor>' is a flash 
memor>' 

30 

6. A subscriber station according to any one of Claims 2 to 5, wherein said 
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processor is a microcontroller. 

7. A subscriber station according to any one of Claims 2 to 6, wherein said 
communications controller comprises a digital signal processor and/or a programmable 

5 storage unit, said processor configures said digital signal processor and/or said 
programmable storage unit with said control code. 

8. A subscriber station according to any preceding Claim, wherein said 
transmitter/receiver comprises at least one aerial and is contained said 

10 communications controller in a common housing to be mounted on a structure to 
permit wireless communication between said subscriber station and said remote central 
station. 

9. A subscriber station according lo Claim 8, comprising a drop cable to a power 
1 5 supply unit and for connection of said user telecommunication equipment. 

10. A wireless telecommunications system comprising at least one said subscriber 
station according to any preceding Claim and a central station, said central station 
being arranged to transmit programming information to said subscriber station for 

20 configuring said subscriber station. 

11. A method of programming a subscriber station for wireless connection of 
telecommunications equipment to a remote central station of a wireless 
telecommunications system, the method comprising: 

25 transmitting wireless programming signals representative of control code from 

said central station to said subscriber station, 

receiving said programming signals at said subscriber station; and 
configuring said subscriber station in response to said control code represented 
by said programming signals down-loaded from said central station. 

30 

12. A method according to Claim 11, comprising: 
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storing said control code down-loaded from said central station; 
executing said control code by means of a processor in said subscriber station 
for configuring said subscriber station. 

5 13, A method according to Claim 12, wherein successive updates of control code 
received from said central station are alternately stored in a respective one of two 
memories, each update having an associated version number, said processor executing 
said control code having the most recent valid version number. 

10 14. A method according to Claim 13, wherein a state machine responds to a reset 
state to determine which memory contains the control code having the most recent 
valid version number. 

15. A method according to Claim 14, wherein each said memory is a flash 
1 5 memory. 

16. A method according to any one of Claims 12 to 15, wherein said processor is 
a microcontroller. 

20 17. A method according to any one of Claims 12 to 16, wherein said processor 
configures a digital signal processor and/or a programmable storage unit in said 
subscriber station with said control code. 

18. A subscriber station substantially as hereinbefore described with reference to 
25 the accompanying drawings. 

19 A wireless communication system substantially as hereinbefore described with 
reference to the accompanying drawings. 

30 20. A method of programming a subscriber station substantially as hereinbefore 
described with reference to the accompanying drawings. 
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